Resubmissions
11/05/2026, 17:21
260511-vxfe2afw5z511/05/2026, 17:10
260511-vpp99say4m511/05/2026, 16:45
260511-t9cz1aez6s5Analysis
- max time kernel
298s - max time network
283s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 17:21
General
- Target Setup.exe
- Size 1009KB
- Sample260511-vxfe2afw5z
- SHA256 a0706de5c6c1b2845c0730135628e05bfcf536fea5f7c64d3681ce289cfa410f
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1228-0-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-4-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-6-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-7-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-9-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-11-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-15-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-23-0x00000000FF660000-0x00000000FF661000-memory.dmp
memory/1228-1150-0x00000000FF7F0000-0x00000000FF7F5000-memory.dmp
memory/1228-1158-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/1228-1202-0x0000000002F20000-0x0000000002F21000-memory.dmp
memory/1228-1209-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/1228-1298-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1563-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1320-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1208-0x0000000002F50000-0x0000000002F51000-memory.dmp
memory/1228-1207-0x0000000002F50000-0x0000000002F51000-memory.dmp
memory/1228-1206-0x0000000002F40000-0x0000000002F41000-memory.dmp
memory/1228-1205-0x0000000002F40000-0x0000000002F41000-memory.dmp
memory/1228-1204-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/1228-1203-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/1228-1201-0x0000000002F20000-0x0000000002F21000-memory.dmp
memory/1228-1200-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/1228-1199-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/1228-1198-0x0000000002F00000-0x0000000002F01000-memory.dmp
memory/1228-1197-0x0000000002F00000-0x0000000002F01000-memory.dmp
memory/1228-1196-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/1228-1195-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/1228-1194-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/1228-1193-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/1228-1192-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1228-1191-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/1228-1190-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/1228-1189-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/1228-1188-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/1228-1187-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/1228-1186-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
memory/1228-1185-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
memory/1228-1184-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/1228-1183-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/1228-1182-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/1228-1181-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/1228-1180-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/1228-1179-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/1228-1178-0x0000000002E60000-0x0000000002E61000-memory.dmp
memory/1228-1177-0x0000000002E60000-0x0000000002E61000-memory.dmp
memory/1228-1176-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/1228-1175-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/1228-1174-0x0000000002E40000-0x0000000002E41000-memory.dmp
memory/1228-1802-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1842-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-2067-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1780-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-2448-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-2803-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-2303-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-3082-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-3347-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-2284-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1766-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1747-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-1173-0x0000000002E40000-0x0000000002E41000-memory.dmp
memory/1228-1172-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/1228-1171-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/1228-1170-0x0000000002E20000-0x0000000002E21000-memory.dmp
memory/1228-1169-0x0000000002E20000-0x0000000002E21000-memory.dmp
memory/1228-1168-0x0000000002E10000-0x0000000002E11000-memory.dmp
memory/1228-1167-0x0000000002E10000-0x0000000002E11000-memory.dmp
memory/1228-1166-0x0000000002E00000-0x0000000002E01000-memory.dmp
memory/1228-1165-0x0000000002E00000-0x0000000002E01000-memory.dmp
memory/1228-1164-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/1228-1163-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/1228-1162-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
memory/1228-1161-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
memory/1228-1160-0x0000000002DC0000-0x0000000002DC1000-memory.dmp
memory/1228-1159-0x0000000002DC0000-0x0000000002DC1000-memory.dmp
memory/1228-1157-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/1228-1156-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
memory/1228-1155-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
memory/1228-3444-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-3443-0x0000000002B60000-0x0000000002BB8000-memory.dmp
memory/1228-3876-0x0000000002B60000-0x0000000002BB8000-memory.dmp